cznic-repo-keys should cert-backup (and remove when uninstalled or updated) the opkg keys
The post-inst script backs up the certificates for updater. However, it does not back up for the opkg (since they are hash-named and the names are not known). Furthermore, we should remove the old ones from the backup, in case we upgrade the keys, so revoked keys are not left there.